Embed Size (px)
Citation preview
Security Architecture in a Collaborative
De-Perimeterised Environment: Factors of Success
Yulia Cherdantseva1 ⋅ Omer Rana1 ⋅ Jeremy Hilton2
1Cardiff University {y.v.cherdantseva | o.f.rana}@cs.cardiff.ac.uk
2Cranfield University [email protected]
1. Security Architecture
2. Collaborative De-Perimeterised Environment
3. Ten Factors of Success
Presentation Outline
4. Conclusions
5. Questions and answers
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What is a Security Architecture?
Security Architecture is the art and science of designing and supervising the construcGon of secure business informaGon systems, i.e. systems that are free from danger, damage, reliable and resistant to failures and aJacks (Sherwood et al.).
The main goal of a SA is an overall business security.
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What is a Security Architecture?
The SABSA Model for Security Architecture
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What is a Security Architecture?
Business View
Architect’s View
Designer’s View
Builder’s View
Tradesman’s View
The SABSA Model for Security Architecture
Service Manager’s View
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What is a Security Architecture?
Business View
Architect’s View
Designer’s View
The SABSA Model for Security Architecture
• Business goal
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What affects a Security Architecture?
• Technical CapabiliGes • The Environment
What is the Collaborative De-perimeterised Environment?
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
De-‐perimeterisaGon is simply the concept of architecGng security for the extended business boundary and not an arbitrary IT boundary.
The Jericho Forum
What is the Collaborative De-perimeterised Environment?
BeJerBuy
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
What is the Collaborative De-perimeterised Environment?
BeJerBuy
Service Provider
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
NO “closed” systems
What is the Collaborative De-perimeterised Environment?
BeJerBuy
Supplier 1 Supplier 2
Service Provider
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
NO “closed” systems
What is the Collaborative De-perimeterised Environment?
BeJerBuy
Supplier 1 Supplier 2
Service Provider
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
The specifics of the Collaborative De-Perimeterised Environement should be taken into account and addressed
at all layers of a Security Architecture and from all points of view
including Business, Architect’s and Designer’s
viewpoints.
The key message
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
10 Factors of Success
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
1. Comprehensive and SystemaGc Approach 2. Adjusted Security Framework 3. Senior Management Role 4. ResponsibiliGes and qualiGes of InfoSec Personnel 5. Up-‐to-‐date Security Policies and Procedures 6. Involvement of Third ParGes 7. InfoSec Training and Awareness 8. Approach to Outsourcing 9. Security Return On Investment 10. Business ConGnuity
Comprehensive protec9on exploitaGon of countermeasures of different layers (people, process and technology)
Comprehensive and Systematic Approach
Systema9c protec9on
1.
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
The SABSA Lifecycle
Issues with exisGng standards, best pracGces and frameworks :
1. Bodies that develop security standards/frameworks are not financially or in any other way accountable for the security failures in organisaGons that follow the standards/frameworks.
2. Do not address changing environment in a Gmely way
An organisa9on has to: 1. Adjust framework to a specific business context 2. Fine-‐tune a framework for the constantly changing environment
2. Adjusted Security Framework
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
3. Senior Management Role
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Some of the quesGons to answer:
• Who are the prospecGve strategic partners? • To what degree does the company want to share or segregate its informaGon? • How much does the company trust a partner or a third party? • What is the liability for informaGon misuse by a partner or a third party?
OPEN-‐MINDEDNESS
4. Responsibilities Allocation and Required Qualities of InfoSec Personnel
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Some newly emerging responsibiliGes:
Achieve consistency with external parGes Develop and implement change-‐introducGon procedures Address security concerns in relaGonships with customers Co-‐ordinate all informaGon protecGon acGviGes
Should cover conGnually emerging technologies in a Gmely manner
Mobile CommunicaGons Social Networking Social Engineering
5. Up-to-date Security Policies and Procedures
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
1. The scope of the interested parGes becomes broader 2. A more in-‐depth involvement of external parGes is required
6. Involvement of Interested Parties
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Example: Parts of an InformaGon Security Policy Document that address protecGon of informaGon outside of an organisaGon’s perimeter should be developed with the close cooperaGon of the parGes involved.
Should be up-‐to-‐date Should make reasoning clear to overcome rote compliance
Two main tasks – to teach users:
1. To exploit common sense when using progressive technologies or working in unforeseen circumstances.
2. To perceive informaGon security as everyone’s personal responsibility
7. Information Security Training and Awareness
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
8. Approach to Outsourcing
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
DifferenGate Service Outsourcing and InfoSec Outsourcing InformaGon Security is not a feature provided by default In-‐house Security Strategy Making is preferred SA should be adjusted to a preferred way of operaGon
BeJerBuy
Cloud Provider InfoSec Strategy
Sherwood et al. propose security ROI calculaGons based on a set of 85 aJributes
9. Security Return On Investment
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Translate security concerns through probability arithmeGc into monetary terms
AOribute Metric Type Measurement Approach Performance Target
Informed Hard Awareness Program Adherence to awareness plan
Son Focus groups or saGsfacGon surveys
Monthly report on all customer feedback relaGng to level of awareness Report from customer and non-‐customer groups
9. Security Return On Investment
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
allows a system to fail in a “good” way
10. Business Continuity
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
BeJerBuy
Supplier 1
Service Provider
allows a system to fail in a “good” way
A SA should be built to avoid the complete dependence on external parGes
10. Business Continuity
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
BeJerBuy
Supplier 1
Service Provider
BackUp
Conclusions The specifics of de-‐perimeterised environment are underesGmated at the level of business, system and security architects
Comprehensive
and systematic
approach Role of
Senior
Management
Awareness
And
Training
Involvement of
interested
parties Up-to-date
Security
policies
Business
Continuity Approach to
Outsourcing Qualities
of Security
Personal
Adjusted
framework
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
Security
ROI
Thank you
The paper and presentaGon was prepared by Yulia Cherdantseva1 ⋅ Omer Rana1 ⋅ Jeremy Hilton2
1Cardiff University {y.v.cherdantseva | o.f.rana}@cs.cardiff.ac.uk
2Cranfield University [email protected]
Security Architecture in a Collaborative De-Perimeterised Environment: Factors of Success
